Non-secret correlations can be used to distribute secrecy 
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A counter-intuitive result in entanglement theory was shown in [PRL 91 037902 (2003)], namely 
that entanglement can be distributed by sending a separable state through a quantum channel. In 
this work, following an analogy between the entanglement and secret key distillation scenarios, we 
derive its classical analog: secrecy can be distributed by sending non-secret correlations through a 
private channel. This strengthens the close relation between entanglement and secrecy. 

PACS numbers: 



I. INTRODUCTION 

Entangled and secret bits are different information re- 
sources that turn out to be closely connected. An entan- 
gled bit, or ebit, corresponds to a maximally entangled 
state of two qubits, 



|*+> = -^(|00> + |ll», 



(1) 



and represents the basic unit of bipartite entanglement 
[l[. A standard problem in entanglement theory is, given 
an arbitrary bipartite quantum state, pab, to determine 
how many ebits are required for its formation or can be 
distilled out of it by local operations and classical com- 
munication (LOCC). 

On the other hand, secret bits, or sbits, are the basic 
unit of classical secret correlations. These arise when two 
honest parties, Alice and Bob, share correlated random 
variables, A and B, whereas the eavesdropper, Eve, holds 
a third random variable E. The total correlations are 
then described by a tripartite probability distribution, 
P(A, B, E). This distribution is a perfect sbit whenever 

P(A = B = 0) = P{A = B = 1) = - 
P(A,B,E)=P(A,B)P(E). 

Note that Alice and Bob's variables are perfectly corre- 
lated, while Eve gets no information whatsoever about 
them from her outcome. Similarly to the case of quan- 
tum states, a basic question is to quantify the number of 
sbits that are required to create a given tripartite prob- 
ability distribution P(A, B, E), or that can be distilled 
out of it by local operations and public communication 
(LOPC). 

There exist several analogies between the entangle- 
ment properties of quantum states and the cryptographic 
properties of the classical probability distributions de- 
rived from them by local measurements 0, In or- 
der to construct these analogies, one has to explicitly 
introduce a third party in the quantum scenario. This 
can easily be done by noting that any bipartite mixed 



state pab can be seen as a tripartite pure state \iP)abe> 
such that trE\ip)(ip\ABE = Pab- Indeed, the environment 
(that is, the part of the global system that is not under 
the honest parties' control) can naturally be associated 
with an adversary party, the eavesdropper. The goal is 
then to connect the entanglement properties of pab to 
the cryptographic properties of those probability distri- 
butions P(A, B, E) that can be written as 

P{A, B, E) = tr {Ma ® M B ® M e \^\ A be)- (2) 

Ma, Mb and Me are positive operators defining a quan- 
tum measurement in each local space, i.e. Mi — 1, 
with i = A, B, E. Of course, the same rule can be ap- 
plied in a multipartite scenario, where the quantum state 
Pabc... is shared among N parties. 

A first rather trivial analogy follows from the fact that 
one sbit can directly be obtained by measuring one ebit 
in, say, the computational basis. This simple observa- 
tion is behind some of the security proofs of quantum 
key distribution protocols Q ■ Beyond this basic analogy, 
other classical analogs of quantum information phenom- 
ena have been derived, and vice-versa. For instance, the 
results of [j| on the existence of what is called negative 
quantum information were translated into the classical 
scenario, obtaining analogous results for the secret-key 
rate [||. In Q, a systematic way of mapping any en- 
tangled state onto a probability distribution containing 
secret correlations was derived. One of the nicest con- 
cepts in this direction is the existence of a cryptographic 
analog of bound entanglement, known as bound informa- 
tion, first conjectured in (3|. Recall that a quantum state 
is bound entangled when, despite being entangled, it is 
impossible to distill pure ebits out of it by LOCC. The 
existence and activation of non-distillable secret correla- 
tions has been demonstrated in Q for the multipartite 
scenario, adapting some known results for multipartite 
bound entangled states. The existence of bipartite bound 
information remains an open question. Other results 
have followed the opposite direction, going from classical 
to quantum: the so-called squashed entanglement is an 
entanglement measure whose construction was inspired 
by a known upper bound on the secret-key rate [9(. In 
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general, the connection between entangled states and se- 
cret correlations is a useful tool in the study of ebits and 
sbits, since it provides much insight into these two fun- 
damental resources. Note, however, that this analogy is 
not a strict correspondence: there are "exceptions" , such 
as the existence of bound entangled states that can be 
mapped into distillable probability distributions [Io| . 

A remarkable result in entanglement theory was ob- 
tained in [llj . where it was shown that entanglement 
can be distributed by sending a separable, non-entangled 
state through a quantum channel. The scope of this work 
is to study whether a similar result holds for probability 
distributions. Following the analogy between ebits and 
sbits, we indeed prove that this is the case: secret corre- 
lations can be distributed by sending non-secret correla- 
tions through a private channel. 

The article is structured as follows. In the next section, 
we introduce the basic rules that apply when translating 
results from the quantum to the classical scenario, and 
vice- versa. Section UTTl briefly reviews the results of [ill ], 
showing how to entangle two distant parties by sending a 
separable state. The main results are given in section HV1 
where we show how to distribute secrecy by sending non- 
secret correlations. Finally, we discuss some relevant is- 
sues and conclude. 



II. ENTANGLEMENT VS. SECRET 
CORRELATIONS 

A standard scenario in entanglement theory consists of 
N distant parties, A, B,C . . ., who share quantum corre- 
lations described by a state p. The state may be mixed 
due to coupling to the environment, E, the overall state 
being |\&), where p = tr ^ | \I/)(\r/ 1 . The two main questions 
in this scenario are: (i) is the preparation of p possi- 
ble by LOCC? and (ii) if not, can pure ebits be distilled 
from p by LOCC? These two questions define the sep- 
arability and distillability problems. When considering 
the key-agreement scenario, many similarities appear (see 
for instance [2, HI])- Now, N distant honest parties and 
an eavesdropper share correlated random variables, de- 
scribed by a probability distribution P(A, B,C, . . . , E). 
The corresponding questions are: (i) can these correla- 
tions be established by LOPC? and (ii) if not, can pure 
sbits be distilled by LOPC? 

Most of the analogies between the two scenarios can 
be summarised as follows: 

secret correlations 
private communication 
public communication 
local actions 



quantum entanglement 
quantum communication 
classical communication 
local operations 

Here a private channel is a classical channel that is only 
accessible to the honest parties. Using these intuitive 
rules, one can often adapt results from entanglement the- 
ory to the secret correlations scenario and vice- versa. For 
instance, a state is bound entangled whenever its forma- 
tion by LOCC is impossible but nevertheless it cannot be 



transformed into pure ebits by LOCC. The corresponding 
concept for secret correlations, knows as bound informa- 
tion, is simply given by a probability distribution that, 
despite its formation by LOPC being impossible, cannot 
be transformed into pure sbits by LOPC. 

More quantitative statements can be made in the bi- 
partite case. In the case of quantum states, the ebit 
represents the basic unit of entanglement. The number 
of ebits per copy that can be distilled out of copies of a 
given quantum state by LOCC defines the distillable en- 
tanglement, Ed [T^. The corresponding classical analog 
is the secret-key rate S(A : B\\E) which gives the num- 
ber of sbits distillable from P{A,B,E) by LOPC [jj]. 
In a similar way, the number of ebits required per copy 
for the formation of an entangled state defines the entan- 
glement cost, Ec- The so-called information of forma- 
tion, I C (A;B\E), introduced in represents its clas- 
sical analog. A probability distribution contains secret 
correlations if, and only if, its information of formation 
is non-zero 
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A useful upper bound for S(A : B\\E) is given by the 
so-called intrinsic information (l3| . The intrinsic infor- 
mation between A and B given E is defined as: 



I(A 



B i E) = min I(A 

E^E 



B\E), 



(3) 



where the minimisation runs over all possible stochastic 
maps P{E\E) defining a new random variable E. The 
quantity I(A : B\E) is the mutual information between 
A and B conditioned on E. It can be written as 

I(A : B\E) = H(A, E) + H(B, E) - H(A, B, E) - H(E), 

where H(X) is the Shannon entropy of the random vari- 
able X. It also gives a lower bound on the information 
of formation [l4j], thus 

S(A : B || E) < I(A : B 1 E) < I C (A; B\E). (4) 

In fact, I C (A; B\E) > if, and only if, I(A : B | E) > 
[Til ]. The intrinsic information plays a key role in the 
proof of our results. 



III. QUANTUM SCENARIO 

Before presenting our results, we summarise the find- 
ings of Ref. on the distribution of entanglement by 
means of a separable state. The scenario consists of two 
initially uncorrelated distant parties who are connected 
by a classical and a quantum channel [15j |. In order to 
entangle two distant qubits, A and B, the parties must 
use the quantum channel, since no entanglement can be 
created by LOCC. Thus one of the parties, say Alice, 
should prepare an additional qubit, C, and send it to 
Bob. Clearly, a sufficient condition for entanglement dis- 
tribution is that the mediating quantum particle C is 
entangled with Alice's quantum system A, so that Bob 
becomes entangled with her after receiving it. Intuitively, 
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one would expect that this is also a necessary condition. 
Remarkably, this is not the (.'(■ISC! 1 . MS shown in Ref. 
where an explicit counterexample is provided in which 
Alice distributes entanglement to Bob by sending a qubit 
C through the quantum channel that is never entangled 
across the partition C — AB. 

The example works as follows. Alice holds two qubits, 
A and C, while Bob has one qubit, B, in the initial state 



^1, 



pabc = -^|* fc ,*_fc,oX*ik,*-fc,o|+^J £|m,i>vM,i| 

k=0 i=0 

where = (|0) + e l7rk / 2 \l))/V2. This state is fully 

separable across all partitions, so it can be prepared by 
LOCC. Alice now applies a controlled-NOT (CNOT) op- 
eration to her qubits, where A (C) is the control (target) 
qubit, resulting in the state 



°~ ABC — g \^ GHz){^ GHz\ 



^2 0ijk\ijk){ijk\ 



(6) 



where \^ GH z)abc = (|000) + |111)) /V5, fai = Ano = 
Pioi = 0no = 1/6, and all other fajk = 0. This state 
is still separable across the C — AB partition [l6[ . Alice 
now sends C to Bob, who applies a CNOT with B (C) 
as the control (target) qubit. After all these steps, Alice 
and Bob share a state 



TABC 



I|$H 

3 1 



AB 



® |0)(0| ( 



2 

3 lAB 



UXil 



(7) 



where Bob has both B and C. This state is distillable. 
Indeed, by measuring particle C in the computational 
basis, Alice and Bob's systems are projected into a max- 
imally entangled state of two qubits with probability 1/3. 



IV. A TRANSLATED CLASSICAL SCENARIO 

We now translate the previous quantum result to the 
key-agreement scenario. Namely, we show that secret 
correlations can be distributed by sending through the 
private channel a random variable that does not have se- 
cret correlations with either Alice and/or Bob. For the 
construction of the example, we can follow the "rules" 
given in section [TTJ Following @ , the initial quantum 
state ([5]) is replaced by the probability distribution ob- 
tained by measuring in the computational bases: 



A B C E P{A,B,C,E) 



e 

1 e i 

1 eio 
1 1 e 

1 f 

1 1 1 fi 



1/6 
1/6 
1/6 
1/6 
1/6 
1/6 



(8) 



Recall that for any separable state there exists an optimal 
measurement by Eve such that the intrinsic information 
for the obtained distribution Q is zero for all choices of 
measurements by Alice and Bob j-'ii . However, Eve's opti- 
mal measurement is not necessarily in the computational 
basis. Thus, it is not immediate that the distribution ([8|) 
contains no secret correlations. However, it is possible to 
prove that this is indeed the case: the distribution has 
zero intrinsic information across the bipartition AC — B, 
since I(AC : B\E) = 0, which does imply that Alice and 
Bob do not share secret correlations. 

Now, Alice performs the (classical) CNOT operation 
on A and C, and sends C through the private channel 
to Bob, who performs the CNOT operation on B and C . 
After Alice's CNOT, the probability distribution is 



A B C E P(A,B,C,E) 



e 

1 ecu 

1 1 eio 
1 1 1 eo 

1 f 

1 1 ft 



1/6 
1/6 
1/6 
1/6 
1/6 
1/6 



(9) 



This distribution has zero intrinsic information across the 
partition C — AB. Indeed, consider the map E — * E in 
which Eve replaces /o and /i by eo , but leaves everything 
else untouched. The resulting probability distribution 
has I(A : B\E) = 0, thus I(AB : C | E) = for ©. 
That is, the C that is sent through the private channel 
does not share secret correlations with A and/or B. 

The final probability distribution between Alice and 
Bob, after Bob's CNOT, is 



A B C E P(A,B,C,E) 



e 

1 1 ecu 

1 1 eio 
1 1 e 

1 f 

1 1 1 h 



1/6 
1/6 
1/6 
1/6 
1/6 
1/6 



(10) 



We now show how Alice and Bob can distill 1 sbit from 
this distribution. Bob holds two of the random variables, 
B and C. He receives C = and C — 1 with probabili- 
ties, 1/3 and 2/3 respectively. By LOPC, Alice and Bob 
keep their outcome whenever C = 1, otherwise they re- 
ject the instance. Thus, with probability 1/3, Alice and 
Bob (and Eve) are correlated according to: 



A 


B 


c 


E 


P(A 7 B,C,E) 











eo 


1/2 


1 


1 





eo 


1/2 



which defines a perfect sbit. Thus, Alice and Bob are 
able to distribute distillable secret correlations by send- 
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ing a random variable, that does not itself have secret 
correlations, through a private channel. 

V. CONCLUDING REMARKS 

In this work, we have constructed the cryptographic 
analog of the distribution of (distillable) entanglement by 
a separable state: (distillable) secrecy can be distributed 
by sending non-secret correlations. This result is com- 
pletely equivalent to its entanglement analog: the use of 
the quantum (private) channel is essential for the success- 
ful entanglement (secrecy) distribution, even though the 
mediating particle (random variable) never has quantum 
(secret) correlations with the sender and/or receiver. 

At first sight, the existence of this cryptographic ana- 
log suggests some interesting possibilities. For instance, 
one might imagine that secrecy could be distributed by 
an untrusted messenger, Charlie, who after transmitting 
the relevant information could not break the established 
secret key. Clearly, this is not the case if the transmit- 
ter can later collaborate with the eavesdropper. Indeed, 
since the information is classical, Charlie can keep a per- 
fect copy of the transmitted random variable, C, and 
give it to Eve. The channel is no longer private, and it 
is known that the distribution of secret correlations by 
LOPC is impossible. 



One could however consider a less restrictive scenario, 
in which the transmitter is still untrusted, but it is as- 
sumed that he does not collaborate with Eve. Can Alice 
and Bob use the above protocol to distill a secret key 
against Eve and Charlie separately? Indeed, they can. 
However, a much simpler protocol already achieves this. 
Alice, Bob and Eve initially share a public perfectly cor- 
related bit, P(a = b = e = 0) = P{a = b = e=l) = 1/2. 
Of course, no key extraction is possible. Then, Alice 
generates a random bit which she sends to Bob, via the 
messenger Charlie. Charlie leaves and may try to break 
the key, but he is not allowed to collaborate with Eve. 
When he delivers the random bit, Alice, Bob and Charlie 
also share a perfectly correlated bit. It is clear that Alice 
and Bob can distill a key against Charlie and Eve (if they 
don't collaborate), by taking the XOR of their two bits. 
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